CVE-2026-77119

A flaw was found in BIND 9. A remote attacker could exploit a vulnerability where a validly signed NSEC3 record from an unrelated DNS zone might be accepted as proof of insecurity. This could downgrade a secure delegation, allowing forged unsigned DNS answers to be accepted by the resolver, potentially leading to DNS spoofing or integrity compromise.

This vulnerability has a Moderate impact on Red Hat products. A flaw in BIND 9 allows a remote attacker to bypass DNSSEC validation by accepting an NSEC3 record from an unrelated zone, leading to the acceptance of forged unsigned DNS answers. The attack complexity is high, limiting the ease of exploitation and contributing to its Moderate severity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.